import type { OAuthCredentials } from "./oauth/types.js";
/**
 * Storage key for Kimi Code OAuth credentials. Kept distinct from the
 * `moonshot` API-key entry so a user can configure BOTH and we always
 * prefer OAuth for the logical `moonshot` provider.
 */
export declare const MOONSHOT_OAUTH_KEY = "moonshot-oauth";
export declare class AuthStorage {
    private data;
    private filePath;
    private loaded;
    /** Per-provider lock to serialize concurrent refresh calls. */
    private refreshLocks;
    constructor(filePath?: string);
    /** Path to the on-disk auth file. Useful for status output. */
    get path(): string;
    /** List provider keys with stored credentials. */
    listProviders(): Promise<string[]>;
    /** True if credentials exist for `provider`. */
    hasCredentials(provider: string): Promise<boolean>;
    /**
     * True if the user has any usable auth for the logical provider. For
     * `moonshot` this is satisfied by either the Kimi OAuth credential or the
     * Moonshot API key.
     */
    hasProviderAuth(provider: string): Promise<boolean>;
    /**
     * True if the active credential for `provider` is a static API key with no
     * refresh mechanism. For `moonshot` this is only true when the Kimi OAuth
     * credential is absent (a present OAuth credential is refreshable).
     */
    isStaticApiKey(provider: string): Promise<boolean>;
    load(): Promise<void>;
    private ensureLoaded;
    getCredentials(provider: string): Promise<OAuthCredentials | undefined>;
    setCredentials(provider: string, creds: OAuthCredentials): Promise<void>;
    clearCredentials(provider: string): Promise<void>;
    clearAll(): Promise<void>;
    /**
     * Returns valid credentials, auto-refreshing if expired.
     * If `forceRefresh` is true, refreshes even if the token hasn't expired
     * (useful when the provider rejects a token with 401 before its stored expiry).
     * Throws if not logged in.
     */
    resolveCredentials(provider: string, opts?: {
        forceRefresh?: boolean;
    }): Promise<OAuthCredentials>;
    /**
     * Returns a valid access token, auto-refreshing if expired.
     * Throws if not logged in.
     */
    resolveToken(provider: string): Promise<string>;
    private save;
}
export declare class NotLoggedInError extends Error {
    provider: string;
    constructor(provider: string);
}
//# sourceMappingURL=auth-storage.d.ts.map